APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters Using VHDX/LNK and SpyGlace Malware
APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters (TL-2026-2134) is a high-severity advanced persistent threat campaign, first published 2026-08-24. It is attributed to APT-C-60 (South Korea) with low confidence, affects N/A Windows endpoints used by recruitment/HR staff (social-engineering, maps to 15 MITRE ATT&CK techniques (T1027, T1036.005, T1059.003), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-2134
- Threat ID
- TL-2026-2134
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-08-24
- Last reviewed
- 2026-08-24
- Attribution
- APT-C-60
- Attribution confidence
- LOW
- Nation-state nexus
- South Korea
- Motivation
- ESPIONAGE
- Target sectors
- recruitment, human resources, corporate
- Target regions
- japan, East Asia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters
Malware and tooling: SpyGrace, git.exe (invoked as gcmd.exe)
JPCERT/CC documented a June-August 2025 spear-phishing campaign by APT-C-60 against Japanese recruitment staff. Attackers impersonating job applicants attached malicious VHDX disk images containing LNK loaders that abuse the legitimate Git executable to launch a script-driven infection chain deploying two downloaders and the SpyGlace backdoor (v3.1.12-3.1.14), using COM hijacking for persistence and GitHub plus the legitimate Statcounter analytics service for C2.
How APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters works
APT-C-60 is an East-Asia-focused cyber-espionage cluster (possibly a sub-cluster of the broader DarkHotel activity set per Positive Technologies and Chuangyu 404 Lab research) that has run recruitment-themed spear-phishing operations against Japanese organizations since at least August 2024, when JPCERT/CC first documented a campaign delivering a malicious VHDX file via Google Drive links to Japanese recruitment contacts, deploying SpyGlace v3.1.6 and abusing Bitbucket and Statcounter for C2 (C2 servers 103.6.244.46 and 103.187.26.176).
In the June-August 2025 wave analyzed here, the group evolved its delivery: rather than hosting the VHDX on Google Drive, the malicious virtual disk image (disguised as a candidate CV, e.g. 'CV & Professional Experience.vhdx') is now attached directly to the phishing email. Opening the VHDX and clicking the embedded LNK ('Resume.rtf.lnk') runs a command that changes into a bundled 'LICENSES.LOG\mingw64\bin' directory and pipes a script file (glog.txt) into the legitimate Git executable (renamed/invoked as gcmd.exe), a living-off-the-land technique that avoids dropping an obviously malicious binary.
The script chain retrieves two downloader stages: WebClassUser.dat (Downloader1), which builds a referrer string encoding the victim's volume serial number and computer name, beacons it to a public Statcounter tracking pixel (statcounter.com/13139439) and to attacker-controlled GitHub repositories (raw.githubusercontent.com URLs built from the same victim identifier) to fetch tasking, and persists via a COM-hijacked CLSID InProcServer32 registry value; and WebCacheR.tmp.dat (Downloader2), which XOR-decodes and loads the SpyGlace backdoor. SpyGlace (versions 3.1.12, 3.1.13, and 3.1.14 were observed being iterated and re-uploaded to GitHub between June 27 and July 16, 2025) supports AES-128-CBC-encrypted download commands, an initial beacon built from MD5/custom-RC4-encoded host data, remote beacon-interval tuning, DLL-module loading/unloading, and screenshot collection staged to a file disguised as a cloud-sync database (Clouds.db). Version 3.1.14 relocated its autorun persistence path to mimic a Windows certificate store directory (%appdata%\Microsoft\SystemCertificates\My\CPLs) and reworked its screenshot-upload routine.
Infrastructure for the 2025 wave combines GitHub accounts/repositories (used both to stage payloads and as a dead-drop for victim-specific tasking files) with a dedicated C2 server (185.181.230.71) serving ASP-based command endpoints, alongside continued abuse of the legitimate Statcounter web-analytics service for low-noise beaconing. Twelve distinct victim device identifiers were recoverable from the GitHub repositories used as dead drops. JPCERT/CC's report cross-references a September 2025 Sangfor writeup on SpyGlace v3.1.14 (a separate campaign outside Japan) and Positive Technologies' DarkHotel-cluster research correlating APT-C-60's TTPs with other suspected DarkHotel-affiliated groups (APT-C-60, APT-Q-12/'Pseudo Hunter'), which several open-source reports tentatively attribute to a South Korea-nexus actor; JPCERT/CC itself does not publish a nation-state attribution.
MITRE ATT&CK techniques used in TL-2026-2134
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1132.001 Data Encoding: Standard Encoding; T1573.001 Encrypted Channel: Symmetric Cryptography
Discovery
T1082 System Information Discovery
Collection
Persistence
T1546.015 Event Triggered Execution: Component Object Model Hijacking
Initial Access
T1566.001 Phishing: Spearphishing Attachment
Resource Development
T1585.003 Establish Accounts: Cloud Accounts; T1608.001 Stage Capabilities: Upload Malware
Affected products and versions in APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters
- N/A — Windows endpoints used by recruitment/HR staff (social-engineering campaign, not a software vulnerability)
Vulnerable versions: N/A
Remediation for APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters
Immediate actions
- Block outbound network connections to identified C2 IPs 185.181.230.71, 103.6.244.46, and 103.187.26.176 and the associated ASP endpoint paths under /wkdo9/
- Alert on and quarantine inbound email attachments with .vhd/.vhdx extensions, particularly disk images sent to recruitment/HR staff from unsolicited external senders claiming to be job applicants
- Hunt endpoints for the identified COM-hijack CLSID registry values (HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32) and the SpyGlace/downloader mutex names
Workarounds
- Block or require justification for mounting of VHD/VHDX disk images delivered as email attachments at the mail-gateway or EDR policy layer
- Monitor and alert on writes to %appdata%\Microsoft\SystemCertificates\My\CPLs and %LocalAppData%\Microsoft\Windows\Clouds\Clouds.db, both used by SpyGlace to disguise its persistence and screenshot-staging artifacts
Longer-term hardening
- Restrict execution of git.exe (and other developer LOLBins) outside expected developer/CI contexts via application-control or Attack Surface Reduction rules, especially when invoked from a mounted virtual-disk image or LNK file
- Add DNS/web-proxy monitoring for anomalous beaconing patterns to raw.githubusercontent.com, statcounter.com, and bitbucket.org that encode host identifiers (volume serial + computer name) in the URL path or referrer header
- Run recurring spear-phishing awareness training for recruitment/HR personnel focused on fabricated CVs and unsolicited disk-image (VHD/VHDX) attachments
Timeline of APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters
- SpyGlace backdoor (TaskController.dll payload) first publicly attributed to APT-C-60 by ThreatBook researchers; the group has operated continuously since at least 2021.
- First documented recruitment-themed spear-phishing campaign against a Japanese organization: victims directed to download a malicious VHDX (containing LNK loader and decoy documents) from Google Drive; SpyGlace v3.1.6 deployed with C2 over Bitbucket and Statcounter, using C2 servers 103.6.244.46 and 103.187.26.176.
- JPCERT/CC publishes 'Attack Exploiting Legitimate Service by APT-C-60,' the first detailed public writeup of the August 2024 campaign, TTPs, and IOCs.
- New campaign wave begins: APT-C-60 shifts VHDX delivery from a Google Drive download link to directly attaching the malicious VHDX (disguised as a CV, e.g. 'CV & Professional Experience.vhdx') to the phishing email.
- SpyGlace v3.1.12 sample uploaded to an attacker-controlled GitHub repository for distribution.
- SpyGlace v3.1.13 deployed in the ongoing campaign, iterating on the June build.
- SpyGlace v3.1.14 released, relocating autorun persistence to a path disguised as a Windows certificate store directory (%appdata%\Microsoft\SystemCertificates\My\CPLs) and reworking the screenshot-upload routine to load from Clouds.db.
- JPCERT/CC's observed June-August 2025 campaign window against Japanese recruitment staff concludes; twelve distinct victim device identifiers recovered from attacker GitHub repositories.
- JPCERT/CC publishes 'Update on Attacks by Threat Group APT-C-60,' detailing the June-August 2025 campaign wave, updated SpyGlace versions, new C2 infrastructure (185.181.230.71), and IOCs; cross-references a September 2025 Sangfor analysis of SpyGlace v3.1.14 in a separate overseas campaign and Positive Technologies' DarkHotel-cluster correlation research.
Sources cited for APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters
- Update on Attacks by Threat Group APT-C-60
- Attack Exploiting Legitimate Service by APT-C-60
- APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage
- APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign
- DarkHotel: A cluster of groups united by common techniques
- APT-C-60 Attacking Job Seekers to Download Weaponized VHDX File from Google Drive to Steal Sensitive Data
- Attack Group APT-C-60 Targets Japan Using Trusted Platforms
- APT-C-60 Campaign: Malicious VHDX Hosted on Google Drive Lures Job Applicants
Threats related to APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters
- SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses Trusted Developer Services (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) to Target Japan
- APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (v3.1.12-3.1.14) via VHDX/LNK and Git (gcmd.exe) LOLBin Abuse
- APT-C-60 2026 Campaign: SpyGlace Backdoor Delivered via LNK Files and Abused Legitimate Services
Detection coverage for TL-2026-2134
As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2134 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.